Page Comparison

...

Setup → Events → Event Console rule packs → Add Rule
Image Modified

Matching Criteria

Here, we need two regular expressions:

Image Modified

1. The first one is applied to the message text and defines three matching groups using the brackets:
   
   

   Code Block
   language bash theme RDark
   .{3} [0-9]+ [0-9:]{8} [0-9]+\.([0-9]{4}) ([^ ]+) (.*)

   
   

   The website https://regex101.com helps you to understand how the regex matches the message text and which groups are created:
   
   Image Modified
   
   These groups can later be accessed using the placeholders \1, \2, and \3 in the message text rewriting. They might also become important when automatic duplicate detection is used. We'll come to that later on.
   
   
2. The second regular expression "^(.*)$" simply matches on any Application text (in our case, it's always "Security", though) and puts it into a matching group. Later, we can access this group using the macro "$MATCH_GROUPS_SYSLOG_APPLICATION_1$".

...